CVE-2020-29596

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

MiniWeb HTTP server 0.8.19 allows remote attackers to cause a denial of service (daemon crash) via a long name for the first parameter in a POST request.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-120

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://packetstormsecurity.com/files/160470/MiniWeb-HTTP-Server-0.8.19-Buffer-Overflow.htmlExploit, Third Party Advisory, VDB Entry
https://securityforeveryone.com/blog/miniweb-http-server-vulnerability-0-day-cve-2020-29596Third Party Advisory
https://sourceforge.net/projects/miniweb/files/miniweb/0.8/Product, Third Party Advisory
https://www.exploit-db.com/exploits/49247Exploit, Third Party Advisory, VDB Entry
https://packetstormsecurity.com/files/160470/MiniWeb-HTTP-Server-0.8.19-Buffer-Overflow.htmlExploit, Third Party Advisory, VDB Entry
https://securityforeveryone.com/blog/miniweb-http-server-vulnerability-0-day-cve-2020-29596Third Party Advisory
https://sourceforge.net/projects/miniweb/files/miniweb/0.8/Product, Third Party Advisory
https://www.exploit-db.com/exploits/49247Exploit, Third Party Advisory, VDB Entry

Timeline

Published: Dec 21, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-295979.8IncomCMS 2.0 has a modules/uploader/showcase/script.php insecure file upload vulnerability. This vulnerability allows unauthenticated attack CVE-2020-295997.8ImageMagick before 6.9.11-40 and 7.x before 7.0.10-40 mishandles the -authenticate option, which allows setting a password for password-prot CVE-2020-296009.8In AWStats through 7.7, cgi-bin/awstats.pl?config= accepts an absolute pathname, even though it was intended to only read a file in the /etc CVE-2020-296019.8The official notary docker images before signer-0.6.1-1 contain a blank password for a root user. System using the notary docker container d CVE-2020-296029.8The official irssi docker images before 1.1-alpine (Alpine specific) contain a blank password for a root user. System using the irssi docker CVE-2020-296034.3In manage_proj_edit_page.php in MantisBT before 2.24.4, any unprivileged logged-in user can retrieve Private Projects' names via the manage_CVE-2020-296046.5An issue was discovered in MantisBT before 2.24.4. A missing access check in bug_actiongroup.php allows an attacker (with rights to create n CVE-2020-296054.3An issue was discovered in MantisBT before 2.24.4. Due to insufficient access-level checks, any logged-in user allowed to perform Group Acti CVE-2020-296077.2A file upload restriction bypass vulnerability in Pluck CMS before 4.7.13 allows an admin privileged user to gain access in the host through CVE-2020-296085.5An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in macOS Big Sur 11.2, Security Update 2021-001 Catal CVE-2020-29619.8Vulnerability in the Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Discovery Framework (Oracle OHS)). Su CVE-2020-296105.5An out-of-bounds read was addressed with improved input validation. This issue is fixed in watchOS 7.2, macOS Big Sur 11.1, Security Update